mjolnir-qa 4.0.0 → 5.0.0

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as BADGE_BAND, A as plainContext, At as isLintFixtureDir, B as shouldUseAscii, Bt as DEDUCTIONS, C as runForensics, Ct as computeCodeText, D as nextStep, Dt as LIMITS, E as buildFooter, Et as DEFAULT_IGNORE_MATCHER, F as padTo, Ft as isRecord$3, G as countOrNull, Gt as deriveEvidenceLevel, H as atomicTempPath, Ht as RULE_CATEGORIES, I as palette, It as parseJsonFile, J as evidenceTag, K as deriveScoreState, Kt as isAdvisoryFinding, L as sanitizeData, Lt as ENGINE_VERSION, M as severityIcon, Mt as isSuppressionActive, N as box, Nt as loadConfig, O as okIcon, Ot as createIgnoreMatcher, P as measure, Pt as readFileBounded, Q as TRUST_RUNGS, R as scoreGauge, Rt as buildEvidenceGraph, S as renderSuppressions, St as parseYamlGuarded, T as FLAKE_GLYPH, Tt as detectFrameworks, U as sweepStaleTempFiles, Ut as SEVERITY_ORDER$1, V as wrapText, Vt as QA_IMPACT_LABELS, W as writeFileAtomic, Wt as TRUST_ORDER, X as testsAnalyzedCell, Y as headlineFor, Z as verdictFor, _t as SCAN_ADAPTERS, at as correlateFindings, b as loadLocalRules, bt as parseAzurePipeline, ct as capForTier, dt as massCeiling, et as SCORE, ft as RETIRED_RULE_IDS, gt as runGit, h as scan_pipeline_exports, ht as resolveGitPath, it as getReachableFiles, j as sectionHeader, jt as ConfigValidationError, k as panel, kt as globToRegExp, lt as computeDimensions, m as runScan$1, mt as getRule, n as KNOWN_RULE_IDS$1, nt as TINT, ot as classifyProvenance, pt as RULES, q as evidenceLevelOf, qt as isValidCategory, rt as buildDependencyGraph, st as computeAgenticProfile, tt as STATUS, ut as deductionFor, v as pluginsGateOpen, vt as SEARCHED_FOR, w as sanitizeErrorText, wt as parseTsFile, x as loadSuppressions, xt as parseWorkflow, y as renderGateNotice, yt as isAzurePipelineFixture, z as shouldColorize, zt as MEASURED_FP } from "./scan-pipeline-CCJdEKNa.mjs";
+import { $ as BADGE_BAND, A as plainContext, At as ConfigValidationError, B as shouldUseAscii, Bt as MEASURED_FP, C as runForensics, Ct as parseTsFile, D as nextStep, Dt as createIgnoreMatcher, E as buildFooter, Et as LIMITS, F as padTo, Ft as isRecord, G as countOrNull, Gt as DEDUCTIONS, H as atomicTempPath, Ht as degradationsSince, I as palette, It as parseJsonFile, J as evidenceTag, Jt as SEVERITY_ORDER$1, K as deriveScoreState, Kt as QA_IMPACT_LABELS, L as sanitizeData, Lt as resolveGitPath, M as severityIcon, Mt as loadConfig, N as box, Nt as readFileBounded, O as okIcon, Ot as globToRegExp, P as measure, Pt as ENGINE_VERSION, Q as TRUST_RUNGS, Qt as isValidCategory, R as scoreGauge, Rt as runGit, S as renderSuppressions, St as computeCodeText, T as FLAKE_GLYPH, Tt as DEFAULT_IGNORE_MATCHER, U as sweepStaleTempFiles, Ut as recordDegradation, V as wrapText, Vt as beginDegradationWindow, W as writeFileAtomic, Wt as summarizeDegradations, X as testsAnalyzedCell, Xt as deriveEvidenceLevel, Y as headlineFor, Yt as TRUST_ORDER, Z as verdictFor, Zt as isAdvisoryFinding, _t as SEARCHED_FOR, at as correlateFindings, b as loadLocalRules, bt as parseWorkflow, ct as capForTier, dt as massCeiling, et as SCORE, ft as compareCodePoints, gt as SCAN_ADAPTERS, h as scan_pipeline_exports, ht as getRule, it as getReachableFiles, j as sectionHeader, jt as isSuppressionActive, k as panel, kt as isLintFixtureDir, lt as computeDimensions, m as runScan$1, mt as RULES, n as KNOWN_RULE_IDS$1, nt as TINT, ot as classifyProvenance, pt as RETIRED_RULE_IDS, q as evidenceLevelOf, qt as RULE_CATEGORIES, rt as buildDependencyGraph, st as computeAgenticProfile, tt as STATUS, ut as deductionFor, v as pluginsGateOpen, vt as isAzurePipelineFixture, w as sanitizeErrorText, wt as detectFrameworks, x as loadSuppressions, xt as parseYamlGuarded, y as renderGateNotice, yt as parseAzurePipeline, z as shouldColorize, zt as buildEvidenceGraph } from "./scan-pipeline-DT8DWAMl.mjs";
 import { accessSync, appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
@@ -433,6 +433,16 @@ const HELP_ENTRIES = [
 		usage: "mjolnir explain <RULE-ID> [--fixtures-root <dir>]",
 		examples: ["mjolnir explain QA-TEST-001", "mjolnir rules --unmeasured"]
 	},
+	{
+		verb: "capability",
+		summary: "the capability registry: every capability at the maturity the machine can prove",
+		usage: "mjolnir capability [--json] [--kind <k>] [--maturity M0..M5] [--id <substring>]",
+		examples: [
+			"mjolnir capability",
+			"mjolnir capability --maturity M2",
+			"mjolnir capability --json > registry.json"
+		]
+	},
 	{
 		verb: "rules",
 		summary: "rule catalog + empirical-measurement stats/health (md/json/stats/health)",
@@ -789,6 +799,7 @@ const GROUPS = [
 			"trust-trend",
 			"evidence-graph",
 			"framework-maturity",
+			"capability",
 			"suppression-gate",
 			"business-case",
 			"release-report",
@@ -1466,6 +1477,49 @@ function ciInstall(root, gate, options = {}) {
 		diffSummary: []
 	};
 }
+//#endregion
+//#region src/cli-io.ts
+const out = (...parts) => console.log(parts.map(String).join(" "));
+const err = (...parts) => console.error(parts.map(String).join(" "));
+function internalErrorMessage(err, emit, debug) {
+	const message = err instanceof Error ? err.message : String(err);
+	emit("mjolnir internal error — this is a bug in Mjölnir, not your repo:");
+	emit(`  ${message}`);
+	if (debug && err instanceof Error && err.stack) emit(err.stack);
+	emit("Rerun with --debug for the stack trace. Please report this:");
+	emit("  https://github.com/Sergey-Bar/Mjolnir/issues");
+}
+/**
+* The ONE error-to-message derivation in `src/`.
+*
+* This tree carried four near-copies: two `errorMessage` (byte-identical) and
+* two `errorText`. The two `errorText` copies were not identical, which is the
+* part that mattered — `String(someObject)` renders `[object Object]`, so the
+* copy that lost the payload turned a hostile non-Error throw into a message
+* that names nothing. The richer arms are kept here, so every call site gets
+* the informative one and the difference stops being a per-file accident.
+*
+* The arms, in order:
+*   Error            -> `.message`. The 99% case, and the only one that
+*                       carries a stack the caller may still want.
+*   string           -> itself. A thrown string is already the message.
+*   plain object     -> `JSON.stringify`. A non-Error throw of `{ code:
+*                       "EISDIR" }` is a REAL failure shape in Node, and
+*                       `[object Object]` hides the only field that says
+*                       what went wrong.
+*   anything else    -> `String(err)`. Symbols and undefined included, so
+*                       nothing vanishes.
+*
+* The call this replaces was `err instanceof Error ? err.message : String(err)`
+* in `src/mcp/server.ts` and `src/commands/doctor.ts`; `tests/cli/summary.spec.ts`
+* already pins the object arm.
+*/
+function errorMessage(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	if (typeof err === "object" && err !== null) return JSON.stringify(err);
+	return String(err);
+}
 /**
 * Fields that participate in the verification digest: identity (ruleId,
 * detectorRevision, file, line, column) + evidence (severity,
@@ -1669,6 +1723,11 @@ function explainRule(ruleId, fixturesRoot) {
 		ok: false,
 		error: `Unknown rule ID "${ruleId}". Run \`mjolnir rules\` for the full catalog.`
 	};
+	const window = beginDegradationWindow();
+	const degraded = () => {
+		const counts = summarizeDegradations(degradationsSince(window));
+		return counts.length > 0 ? { exampleDegraded: counts } : {};
+	};
 	const fixturePath = firstFixtureFile(join(fixturesRoot, ruleId, "must-fire"));
 	if (!fixturePath) return {
 		ok: true,
@@ -1678,9 +1737,11 @@ function explainRule(ruleId, fixturesRoot) {
 	try {
 		text = readFileSync(fixturePath, "utf8").replace(/\r\n/g, "\n");
 	} catch {
+		recordDegradation("explain-fixture-unreadable");
 		return {
 			ok: true,
-			rule
+			rule,
+			...degraded()
 		};
 	}
 	const normalizedPath = fixturePath.replaceAll("\\", "/");
@@ -1690,9 +1751,11 @@ function explainRule(ruleId, fixturesRoot) {
 		else try {
 			ast = isAzurePipelineFixture(normalizedPath) ? parseAzurePipeline(text) : parseWorkflow(text);
 		} catch {
+			recordDegradation("explain-workflow-parse-failed");
 			return {
 				ok: true,
-				rule
+				rule,
+				...degraded()
 			};
 		}
 	}
@@ -1709,9 +1772,11 @@ function explainRule(ruleId, fixturesRoot) {
 			codeText
 		});
 	} catch {
+		recordDegradation("explain-rule-crash");
 		return {
 			ok: true,
-			rule
+			rule,
+			...degraded()
 		};
 	}
 	const example = findings[0];
@@ -1773,7 +1838,13 @@ function renderExplain(result, width = DEFAULT_EXPLAIN_WIDTH) {
 		pushBody(f.fix);
 		lines.push("");
 		pushBody(`Example from this rule's own must-fire fixture: ${result.exampleFixtureRelPath ?? result.exampleFixturePath ?? "(unknown path)"}`);
-	} else for (const seg of wrapText("No example available — run this command from a mjolnir checkout (or pass --fixtures-root) so the fixture that proves this rule works can be shown as a real example.", width)) lines.push(seg);
+	} else {
+		for (const seg of wrapText("No example available — run this command from a mjolnir checkout (or pass --fixtures-root) so the fixture that proves this rule works can be shown as a real example.", width)) lines.push(seg);
+		for (const entry of result.exampleDegraded ?? []) {
+			lines.push("");
+			for (const seg of wrapText(`NOT SHOWN — ${entry.reason} (${entry.count}): the example is missing because the check did not complete, not because the rule found nothing.`, width)) lines.push(seg);
+		}
+	}
 	lines.push("");
 	lines.push("WHAT WOULD CHANGE THE VERDICT");
 	for (const c of whatWouldChangeTheVerdict(r)) pushBody(`- ${c}`);
@@ -1852,7 +1923,7 @@ function whatWouldChangeTheVerdict(r) {
 /** Structural validation of the loaded JSON (hostile-input safe). */
 function parseScanJson(raw) {
 	try {
-		return parseJsonFile(raw, "scan result", (v) => isRecord$3(v) && v.schemaVersion === 1 && Array.isArray(v.findings) && Boolean(v.analysisStatus) && typeof v.partial === "boolean");
+		return parseJsonFile(raw, "scan result", (v) => isRecord(v) && v.schemaVersion === 1 && Array.isArray(v.findings) && Boolean(v.analysisStatus) && typeof v.partial === "boolean");
 	} catch {
 		return;
 	}
@@ -3064,15 +3135,11 @@ async function handleToolCall(call) {
 			id: call.id,
 			error: {
 				code: MCP_ERRORS.INTERNAL,
-				message: errorMessage$1(err)
+				message: errorMessage(err)
 			}
 		};
 	}
 }
-/** Normalize any thrown value to a string (unit-tested both arms). */
-function errorMessage$1(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 /** JSON-RPC request shape validation (strict — §21). */
 function validateRequest(msg) {
 	if (typeof msg !== "object" || msg === null) return {
@@ -3175,24 +3242,6 @@ async function handleMcpMessage(msg) {
 	};
 }
 //#endregion
-//#region src/cli-io.ts
-const out = (...parts) => console.log(parts.map(String).join(" "));
-const err = (...parts) => console.error(parts.map(String).join(" "));
-function internalErrorMessage(err, emit, debug) {
-	const message = err instanceof Error ? err.message : String(err);
-	emit("mjolnir internal error — this is a bug in Mjölnir, not your repo:");
-	emit(`  ${message}`);
-	if (debug && err instanceof Error && err.stack) emit(err.stack);
-	emit("Rerun with --debug for the stack trace. Please report this:");
-	emit("  https://github.com/Sergey-Bar/Mjolnir/issues");
-}
-/**
-* The single error-to-message derivation shared by every catch site:
-* Error instances render their message; anything else is stringified
-* honestly (a hostile non-Error throw must surface, not vanish).
-*/
-const errorMessage = (err) => err instanceof Error ? err.message : String(err);
-//#endregion
 //#region src/mcp/transport.ts
 /**
 * MCP stdio transport loop (blueprint §21 — the framing around the
@@ -4337,13 +4386,13 @@ function renderMermaid(result) {
 		lines.push("  class NOTESTS unknown;");
 		return lines.join("\n");
 	}
-	const frameworks = [...result.frameworks].sort((a, b) => a.localeCompare(b));
+	const frameworks = [...result.frameworks].sort(compareCodePoints);
 	if (frameworks.length === 0) lines.push(`  ${rootId} --> FW_unknown["Frameworks: UNKNOWN"]`);
 	else for (const fw of frameworks) {
 		const fwId = `FW_${sanitizeId(fw)}`;
 		lines.push(`  ${rootId} --> ${fwId}["${escapeLabel(fw)}"]`);
 	}
-	const dimensions = [...result.dimensions].sort((a, b) => a.category.localeCompare(b.category));
+	const dimensions = [...result.dimensions].sort((a, b) => compareCodePoints(a.category, b.category));
 	const styleAssignments = [];
 	for (const dim of dimensions) {
 		const catId = `CAT_${sanitizeId(dim.category)}`;
@@ -4549,21 +4598,11 @@ const EVIDENCE_VALUES = /* @__PURE__ */ new Set([
 	"E2"
 ]);
 const TRUST_VALUES = new Set(TRUST_ORDER);
-/** Human message for any thrown value — never "undefined"/"[object Object]". */
-function errorText$1(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	if (typeof err === "object" && err !== null) return JSON.stringify(err);
-	return String(err);
-}
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function fail(message) {
 	throw new Error(message);
 }
 function requireRecord(value, label) {
-	if (!isRecord$2(value)) fail(`${label} must be an object`);
+	if (!isRecord(value)) fail(`${label} must be an object`);
 	return value;
 }
 function requireString(value, label) {
@@ -4661,7 +4700,7 @@ function validateReportJson(text) {
 	try {
 		parsed = JSON.parse(text);
 	} catch (err) {
-		throw new Error(`not valid JSON (${errorText$1(err)})`, { cause: err });
+		throw new Error(`not valid JSON (${errorMessage(err)})`, { cause: err });
 	}
 	const doc = requireRecord(parsed, "the report is not an object");
 	if (doc.schemaVersion !== 1) fail(`unsupported schemaVersion ${JSON.stringify(doc.schemaVersion)} — expected schemaVersion 1`);
@@ -4685,7 +4724,7 @@ function validateReportJson(text) {
 	const partialMarkers = status["discovery"] !== "complete" || status["rules"] !== "complete" || Number(status["skippedFiles"]) > 0 || Number(status["rulesCrashed"] ?? 0) > 0 || Array.isArray(status["reasons"]) && status["reasons"].length > 0;
 	if (doc.partial === false && partialMarkers) fail("partial=false conflicts with analysisStatus");
 	if (doc.partial === true && typeof doc.score === "number" && doc.score === 100) fail("partial reports cannot have a perfect score");
-	if ((isRecord$2(doc.scopeIntegrity) ? doc.scopeIntegrity : void 0)?.["scopeVerdict"] === "PARTIAL" && doc.partial === false) fail("partial=false conflicts with scopeIntegrity");
+	if ((isRecord(doc.scopeIntegrity) ? doc.scopeIntegrity : void 0)?.["scopeVerdict"] === "PARTIAL" && doc.partial === false) fail("partial=false conflicts with scopeIntegrity");
 	return parsed;
 }
 /** Load + validate a saved report from disk. Throws on any problem. */
@@ -4701,7 +4740,7 @@ function reportExists(reportPath) {
 }
 function identityOf(result) {
 	const identity = result.runIdentity;
-	return isRecord$2(identity) ? identity : void 0;
+	return isRecord(identity) ? identity : void 0;
 }
 /**
 * Classify a loaded report. Pure — it reads the report and the caller's
@@ -4723,7 +4762,7 @@ function classifySavedReport(result, expected) {
 	};
 	const commit = typeof identity["commit"] === "string" ? identity["commit"] : void 0;
 	const candidate = identity["candidate"];
-	const candidateManifestId = isRecord$2(candidate) && typeof candidate["manifestId"] === "string" ? candidate["manifestId"] : void 0;
+	const candidateManifestId = isRecord(candidate) && typeof candidate["manifestId"] === "string" ? candidate["manifestId"] : void 0;
 	if (expected !== void 0) {
 		if (expected.scanId !== void 0 && expected.scanId !== scanId) return {
 			state: "OPEN",
@@ -4893,7 +4932,7 @@ function buildArtifactIdentity(result, commit) {
 		detectorRevisions: [...revisions.entries()].map(([ruleId, detectorRevision]) => ({
 			ruleId,
 			detectorRevision
-		})).sort((a, b) => a.ruleId.localeCompare(b.ruleId)),
+		})).sort((a, b) => compareCodePoints(a.ruleId, b.ruleId)),
 		evidenceInventory: {
 			totalFindings: result.findings.length,
 			corroborated,
@@ -5625,7 +5664,7 @@ async function runWhyCommand(argv, io = {
 		try {
 			result = loadSavedReport(reportPath);
 		} catch (err) {
-			io.err(`mjolnir why: cannot read ${reportPath}: ${errorText$1(err)}`);
+			io.err(`mjolnir why: cannot read ${reportPath}: ${errorMessage(err)}`);
 			return 2;
 		}
 	} else {
@@ -5644,7 +5683,7 @@ async function runWhyCommand(argv, io = {
 				strict: argv.includes("--strict")
 			});
 		} catch (err) {
-			io.err(`mjolnir why: scan failed: ${errorText$1(err)}`);
+			io.err(`mjolnir why: scan failed: ${errorMessage(err)}`);
 			return 20;
 		}
 	}
@@ -6007,7 +6046,7 @@ function computeDebt(result) {
 		label,
 		count: v.count,
 		estHoursPerQuarter: Math.round(v.hours * 10) / 10,
-		ruleIds: [...v.ruleIds].sort((a, b) => a.localeCompare(b))
+		ruleIds: [...v.ruleIds].sort(compareCodePoints)
 	})).sort((a, b) => b.estHoursPerQuarter - a.estHoursPerQuarter);
 	return {
 		classes,
@@ -6542,8 +6581,8 @@ async function computeImpact(root, options) {
 		baseRef,
 		headRef,
 		...baseTreeTruncated ? { baseTreeTruncated } : {},
-		resolved: resolved.sort((a, b) => a.file.localeCompare(b.file)),
-		introduced: introduced.sort((a, b) => a.file.localeCompare(b.file)),
+		resolved: resolved.sort((a, b) => compareCodePoints(a.file, b.file)),
+		introduced: introduced.sort((a, b) => compareCodePoints(a.file, b.file)),
 		unknownFacts
 	};
 }
@@ -6802,7 +6841,7 @@ function tryReadPackageJson(rootDir) {
 	const p = join(rootDir, "package.json");
 	if (!existsSync(p)) return null;
 	try {
-		return parseJsonFile(readFileSync(p, "utf8"), p, isRecord$3);
+		return parseJsonFile(readFileSync(p, "utf8"), p, isRecord);
 	} catch {
 		return null;
 	}
@@ -7598,7 +7637,7 @@ function computeSelectorHealth(root, ignoreMatcher = DEFAULT_IGNORE_MATCHER) {
 		}
 	};
 	walk(root);
-	return specs.sort((a, b) => a.score - b.score || a.file.localeCompare(b.file));
+	return specs.sort((a, b) => a.score - b.score || compareCodePoints(a.file, b.file));
 }
 //#endregion
 //#region src/cli-handlers.ts
@@ -8074,7 +8113,7 @@ async function runPrCommentCommand(argv, io = {
 			}));
 			return 0;
 		} catch (err) {
-			io.err(`error: cannot read ${fromPath}: ${errorText$1(err)}`);
+			io.err(`error: cannot read ${fromPath}: ${errorMessage(err)}`);
 			return 10;
 		}
 	}
@@ -8567,7 +8606,7 @@ function computeDetectorHashes(rules, rulesDir, retiredIds = []) {
 	return manifest;
 }
 function loadManifest(path) {
-	return parseJsonFile(readFileSync(path, "utf8"), path, (v) => isRecord$3(v));
+	return parseJsonFile(readFileSync(path, "utf8"), path, (v) => isRecord(v));
 }
 //#endregion
 //#region src/commands/doctor.ts
@@ -8599,10 +8638,6 @@ const VALID_REASON_CODES = /* @__PURE__ */ new Set([
 	"family-fallback-lockstep",
 	"migration-deferred-next-measurement"
 ]);
-/** Uniform error rendering for doctor details (Error or thrown-as-string). */
-function errorText(e) {
-	return e instanceof Error ? e.message : String(e);
-}
 const ui$8 = plainContext();
 /** Builds the check record: `ok` is always the pass-mirror of `status`. */
 function check(name, status, details) {
@@ -8744,7 +8779,7 @@ function checkTierEnforcement(verdictsDir, rules = RULES) {
 			const lines = readFileSync(join(verdictsDir, f), "utf8").split("\n").filter((l) => l.trim().length > 0);
 			for (const line of lines) try {
 				const parsed = JSON.parse(line);
-				if (!isRecord$3(parsed)) continue;
+				if (!isRecord(parsed)) continue;
 				const entry = parsed;
 				if (entry.verdict === "TP" || entry.verdict === "FP") {
 					if (typeof entry.ruleId === "string") live.set(entry.ruleId, (live.get(entry.ruleId) ?? 0) + 1);
@@ -8752,7 +8787,7 @@ function checkTierEnforcement(verdictsDir, rules = RULES) {
 			} catch {}
 		}
 	} catch (e) {
-		return check("tier-enforcement", "inconclusive", [`INCONCLUSIVE: live verdicts unreadable — ${errorText(e)} (owner ruling 2026-09-08, L4)`]);
+		return check("tier-enforcement", "inconclusive", [`INCONCLUSIVE: live verdicts unreadable — ${errorMessage(e)} (owner ruling 2026-09-08, L4)`]);
 	}
 	if (live.size > 0) for (const [id, n] of live) classifiedPerRule.set(id, n);
 	const coreRules = rules.filter((r) => effectiveTier(r) === "core");
@@ -8852,7 +8887,7 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
 	if (existsSync(allowlistPath)) try {
 		const raw = JSON.parse(readFileSync(allowlistPath, "utf8"));
-		if (!isRecord$3(raw)) {
+		if (!isRecord(raw)) {
 			ok = false;
 			details.push("typecheck-allowlist.json is not an object");
 		} else if (Array.isArray(raw.entries)) details.push(`Layer A typecheck allowlist: ${raw.entries.length} justified entr(ies)`);
@@ -8902,7 +8937,7 @@ function checkRevisionIntegrity(repoRoot, rules = RULES) {
 	try {
 		current = computeDetectorHashes(rules, rulesDir);
 	} catch (e) {
-		return check("revision-integrity", "inconclusive", [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]);
+		return check("revision-integrity", "inconclusive", [`INCONCLUSIVE: detector hash computation failed — ${errorMessage(e)}`]);
 	}
 	const failures = [];
 	for (const rule of rules) {
@@ -8966,7 +9001,7 @@ function checkMeasurementConsistency(verdictsDir, sidecarPath, rules = RULES, me
 			let row;
 			try {
 				const parsed = JSON.parse(trimmed);
-				if (!isRecord$3(parsed)) {
+				if (!isRecord(parsed)) {
 					failures.push(`${f}: unparseable verdict row (corpus integrity)`);
 					continue;
 				}
@@ -8983,10 +9018,10 @@ function checkMeasurementConsistency(verdictsDir, sidecarPath, rules = RULES, me
 	let sidecar = {};
 	if (existsSync(sidecarPath)) try {
 		const parsed = JSON.parse(readFileSync(sidecarPath, "utf8"));
-		if (!isRecord$3(parsed)) failures.push("sidecar is not a valid object — regenerate the measurement artifacts");
+		if (!isRecord(parsed)) failures.push("sidecar is not a valid object — regenerate the measurement artifacts");
 		else sidecar = parsed;
 	} catch (e) {
-		failures.push(`sidecar unreadable/malformed: ${errorText(e)} — regenerate the measurement artifacts`);
+		failures.push(`sidecar unreadable/malformed: ${errorMessage(e)} — regenerate the measurement artifacts`);
 	}
 	else {
 		const needsSidecar = Object.keys(measuredFp).filter((id) => measuredFp[id]?.detectorRevision !== 1);
@@ -9383,7 +9418,7 @@ function runSummaryCommand(argv, io = {
 	try {
 		result = loadSavedReport(reportPath);
 	} catch (err) {
-		io.err(`mjolnir summary: cannot read ${reportPath}: ${errorText$1(err)}`);
+		io.err(`mjolnir summary: cannot read ${reportPath}: ${errorMessage(err)}`);
 		return 2;
 	}
 	const env = process.env;
@@ -9402,7 +9437,7 @@ function runSummaryCommand(argv, io = {
 	if (stepSummaryPath) try {
 		appendFileSync(stepSummaryPath, `${summary}\n`);
 	} catch (err) {
-		io.err(`mjolnir summary: could not write $GITHUB_STEP_SUMMARY (${errorText$1(err)}); printing to stdout instead.`);
+		io.err(`mjolnir summary: could not write $GITHUB_STEP_SUMMARY (${errorMessage(err)}); printing to stdout instead.`);
 		io.out(summary);
 	}
 	else io.out(summary);
@@ -9710,7 +9745,7 @@ function runHandoffCommand(argv, io = {
 	try {
 		result = loadSavedReport(reportPath);
 	} catch (err) {
-		io.err(`mjolnir handoff: cannot read ${reportPath}: ${errorText$1(err)}`);
+		io.err(`mjolnir handoff: cannot read ${reportPath}: ${errorMessage(err)}`);
 		return 2;
 	}
 	io.out(renderHandoff(result, {
@@ -11116,13 +11151,22 @@ async function runReleaseReportCommand(argv, io) {
 * So the execution block is empty and says so, and the findings live in the
 * `mjolnir` extension block where they are honestly labelled as static
 * analysis. The file is a findings report in a familiar shape, not a test run.
+*
+* The TOP-LEVEL status is the same claim and is now held to it. It used to be
+* computed (`partial ? "interrupted" : hasError ? "failed" : "passed"`), so
+* the clean case shipped `{status: "passed", totalTests: 0}` — a green test
+* run over zero tests, in the one field a Playwright consumer reads first. The
+* per-finding statuses were fixed; this one was not. It is now the literal
+* `interrupted`, and what the scan actually found is reported as
+* `mjolnir.scanOutcome` instead of being smuggled into the run status.
 */
 const ui$6 = plainContext();
 function buildPlaywrightReport(result) {
 	const now = /* @__PURE__ */ new Date();
 	const partial = result.partial === true;
 	const hasError = result.findings.some((f) => f.severity === "error");
-	const status = partial ? "interrupted" : hasError ? "failed" : "passed";
+	const status = "interrupted";
+	const scanOutcome = partial ? "partial" : hasError ? "blocked" : "clean";
 	return {
 		version: 1,
 		startTime: now.toISOString(),
@@ -11135,7 +11179,7 @@ function buildPlaywrightReport(result) {
 		suites: [],
 		mjolnir: {
 			execution: "STATIC_ANALYSIS",
-			status,
+			scanOutcome,
 			partial,
 			score: result.score,
 			framework: result.frameworks[0] ?? "unknown",
@@ -11232,16 +11276,39 @@ function recordTrend(root, snapshot) {
 		return false;
 	}
 }
-function loadTrend(root, limit = 20) {
+function loadTrendDetail(root, limit = 20) {
 	const path = trendPath(root);
-	if (!existsSync(path)) return [];
-	return readFileSync(path, "utf8").trim().split("\n").filter(Boolean).map((line) => {
-		try {
-			return JSON.parse(line);
-		} catch {
-			return null;
-		}
-	}).filter((s) => s !== null).slice(-limit);
+	if (!existsSync(path)) return {
+		snapshots: [],
+		corruptLines: 0
+	};
+	const lines = readFileSync(path, "utf8").trim().split("\n").filter(Boolean);
+	let corruptLines = 0;
+	return {
+		snapshots: lines.map((line) => {
+			try {
+				return JSON.parse(line);
+			} catch {
+				recordDegradation("trend-record-unparseable");
+				corruptLines++;
+				return null;
+			}
+		}).filter((s) => s !== null).slice(-limit),
+		corruptLines
+	};
+}
+/**
+* Say what was discarded, on stderr, and report whether the history is
+* readable at all. Returns the snapshots so the caller does not read the
+* file twice.
+*/
+function readTrendOrDisclose(root, limit, io) {
+	const { snapshots, corruptLines } = loadTrendDetail(root, limit);
+	if (corruptLines > 0) io.err(`mjolnir trend: ${corruptLines} unreadable line(s) in ${trendPath(root)} were discarded; the history below is not the whole file.`);
+	return {
+		snapshots,
+		readable: corruptLines === 0 || snapshots.length > 0
+	};
 }
 async function runTrendCommand(argv, io) {
 	const subcommand = argv[0] ?? "show";
@@ -11286,8 +11353,12 @@ async function runTrendCommand(argv, io) {
 	}
 	if (subcommand === "show") {
 		const limitStr = argv.find((a) => a.startsWith("--limit="))?.split("=")[1] ?? "20";
-		const snapshots = loadTrend(target, parseInt(limitStr, 10));
+		const { snapshots, readable } = readTrendOrDisclose(target, parseInt(limitStr, 10), io);
 		if (snapshots.length === 0) {
+			if (!readable) {
+				io.err(`mjolnir trend show: ${trendPath(target)} exists but no line in it could be parsed. That is unreadable history, not an empty history.`);
+				return 20;
+			}
 			io.out("No trend data yet. Run 'mjolnir trend record' first.");
 			return 0;
 		}
@@ -11301,12 +11372,12 @@ async function runTrendCommand(argv, io) {
 		return 0;
 	}
 	if (subcommand === "diff") {
-		const snapshots = loadTrend(target, 2);
-		if (snapshots.length < 2) {
-			io.out("Need at least 2 snapshots for diff. Run 'mjolnir trend record' more than once.");
-			return 0;
-		}
+		const { snapshots, readable } = readTrendOrDisclose(target, 2, io);
 		if (snapshots.length < 2) {
+			if (!readable) {
+				io.err(`mjolnir trend diff: ${trendPath(target)} exists but no line in it could be parsed, so there is no history to diff.`);
+				return 20;
+			}
 			io.out("Need at least 2 snapshots for diff. Run 'mjolnir trend record' more than once.");
 			return 0;
 		}
@@ -11618,7 +11689,7 @@ function runtimeFailuresFromReport(parsed) {
 	return evidence;
 }
 function buildQuarantineProposals(evidence) {
-	return evidence.filter((item) => item.attempts >= 2 && item.everFailed).sort((a, b) => b.attempts - a.attempts || a.file.localeCompare(b.file) || a.line - b.line).map((item, index) => ({
+	return evidence.filter((item) => item.attempts >= 2 && item.everFailed).sort((a, b) => b.attempts - a.attempts || compareCodePoints(a.file, b.file) || a.line - b.line).map((item, index) => ({
 		id: `Q-${String(index + 1).padStart(3, "0")}`,
 		ruleId: item.ruleId,
 		file: item.file,
@@ -12020,7 +12091,7 @@ async function runDashboardCommand(argv, io) {
 		return 10;
 	}
 	try {
-		const { runScan } = await import("./scan-pipeline-Bg-46cLS.mjs");
+		const { runScan } = await import("./scan-pipeline-DNYbnWjE.mjs");
 		const result = await runScan({
 			target,
 			json: true,
@@ -12143,6 +12214,1282 @@ function runEnterpriseCommand(argv, io) {
 	return 10;
 }
 //#endregion
+//#region src/frameworks/provider-capability-contract.ts
+const CI_PROVIDER_CAPABILITY_SCHEMA = "m30.ci-provider-capabilities@1";
+const CI_PROVIDER_IDS = [
+	"github-actions",
+	"azure-pipelines",
+	"jenkins",
+	"gitlab-ci"
+];
+function unsupported(reason) {
+	return {
+		state: "unsupported",
+		reason
+	};
+}
+const CI_PROVIDER_CAPABILITY_RECORDS = [
+	{
+		schema: CI_PROVIDER_CAPABILITY_SCHEMA,
+		provider: "github-actions",
+		assurance: {
+			mode: "bounded",
+			certification: "not-claimed"
+		},
+		permissions: {
+			defaultToken: "read-only",
+			forkPullRequestToken: "read-only",
+			untrustedInputSecrets: "unavailable",
+			writeAccess: "not-granted"
+		},
+		capabilities: {
+			triggers: {
+				state: "supported",
+				semantics: {
+					source: "github-events",
+					pathFilters: "narrow-only",
+					untrustedInput: "data-only"
+				}
+			},
+			forks: {
+				state: "supported",
+				semantics: {
+					token: "read-only",
+					secrets: "unavailable",
+					checkoutCredentials: "not-persisted"
+				}
+			},
+			conditions: {
+				state: "supported",
+				semantics: {
+					evaluator: "github-expressions",
+					untrustedExpressions: "data-only",
+					skippedGate: "invalid"
+				}
+			},
+			matrix: {
+				state: "supported",
+				semantics: {
+					execution: "strategy-matrix",
+					aggregation: "all-jobs-must-pass",
+					toleratedFailures: "non-gates-only"
+				}
+			},
+			artifacts: {
+				state: "supported",
+				semantics: {
+					store: "run-artifacts",
+					binding: "run-and-candidate-bound",
+					untrustedUpload: "denied"
+				}
+			},
+			cache: {
+				state: "supported",
+				semantics: {
+					scope: "action-cache",
+					keying: "integrity-keyed",
+					forkWrite: "denied"
+				}
+			},
+			approvals: {
+				state: "supported",
+				semantics: {
+					mechanism: "required-checks",
+					defaultMode: "advisory",
+					staleApproval: "invalid"
+				}
+			},
+			failureHandling: {
+				state: "supported",
+				semantics: {
+					retry: "bounded-advisory",
+					continueOnError: "non-gates-only",
+					maskedGate: "blocking"
+				}
+			}
+		}
+	},
+	{
+		schema: CI_PROVIDER_CAPABILITY_SCHEMA,
+		provider: "azure-pipelines",
+		assurance: {
+			mode: "bounded",
+			certification: "not-claimed"
+		},
+		permissions: {
+			defaultToken: "not-applicable",
+			forkPullRequestToken: "unsupported",
+			untrustedInputSecrets: "unavailable",
+			writeAccess: "not-granted"
+		},
+		capabilities: {
+			triggers: {
+				state: "supported",
+				semantics: {
+					source: "azure-resource-triggers",
+					pathFilters: "narrow-only",
+					untrustedInput: "data-only"
+				}
+			},
+			forks: unsupported("Azure fork pull-request token isolation is not part of this bounded contract."),
+			conditions: {
+				state: "supported",
+				semantics: {
+					evaluator: "azure-expressions",
+					untrustedExpressions: "data-only",
+					skippedGate: "invalid"
+				}
+			},
+			matrix: {
+				state: "supported",
+				semantics: {
+					execution: "jobs-matrix",
+					aggregation: "all-jobs-must-pass",
+					toleratedFailures: "non-gates-only"
+				}
+			},
+			artifacts: {
+				state: "supported",
+				semantics: {
+					store: "pipeline-artifacts",
+					binding: "run-and-candidate-bound",
+					untrustedUpload: "denied"
+				}
+			},
+			cache: unsupported("Azure cache trust and restoration semantics are not part of this bounded contract."),
+			approvals: {
+				state: "supported",
+				semantics: {
+					mechanism: "branch-policy",
+					defaultMode: "advisory",
+					staleApproval: "invalid"
+				}
+			},
+			failureHandling: {
+				state: "supported",
+				semantics: {
+					retry: "bounded-advisory",
+					continueOnError: "non-gates-only",
+					maskedGate: "blocking"
+				}
+			}
+		}
+	},
+	{
+		schema: CI_PROVIDER_CAPABILITY_SCHEMA,
+		provider: "jenkins",
+		assurance: {
+			mode: "bounded",
+			certification: "not-claimed"
+		},
+		permissions: {
+			defaultToken: "not-applicable",
+			forkPullRequestToken: "unsupported",
+			untrustedInputSecrets: "unavailable",
+			writeAccess: "not-granted"
+		},
+		capabilities: {
+			triggers: {
+				state: "supported",
+				semantics: {
+					source: "jenkins-external-triggers",
+					pathFilters: "narrow-only",
+					untrustedInput: "data-only"
+				}
+			},
+			forks: unsupported("Jenkins fork identity and token isolation are controller-specific and unsupported here."),
+			conditions: unsupported("Untrusted Groovy condition execution is not part of this bounded contract."),
+			matrix: {
+				state: "supported",
+				semantics: {
+					execution: "parallel-axis",
+					aggregation: "all-jobs-must-pass",
+					toleratedFailures: "non-gates-only"
+				}
+			},
+			artifacts: {
+				state: "supported",
+				semantics: {
+					store: "workspace-archive",
+					binding: "run-and-candidate-bound",
+					untrustedUpload: "denied"
+				}
+			},
+			cache: unsupported("Jenkins cache plugins and restoration trust are not part of this bounded contract."),
+			approvals: {
+				state: "supported",
+				semantics: {
+					mechanism: "manual-input",
+					defaultMode: "advisory",
+					staleApproval: "invalid"
+				}
+			},
+			failureHandling: {
+				state: "supported",
+				semantics: {
+					retry: "bounded-advisory",
+					continueOnError: "non-gates-only",
+					maskedGate: "blocking"
+				}
+			}
+		}
+	},
+	{
+		schema: CI_PROVIDER_CAPABILITY_SCHEMA,
+		provider: "gitlab-ci",
+		assurance: {
+			mode: "bounded",
+			certification: "not-claimed"
+		},
+		permissions: {
+			defaultToken: "not-applicable",
+			forkPullRequestToken: "unsupported",
+			untrustedInputSecrets: "unavailable",
+			writeAccess: "not-granted"
+		},
+		capabilities: {
+			triggers: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			forks: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			conditions: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			matrix: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			artifacts: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			cache: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			approvals: unsupported("GitLab provider execution is not claimed by the bounded M30 contract."),
+			failureHandling: unsupported("GitLab provider execution is not claimed by the bounded M30 contract.")
+		}
+	}
+];
+new Map(CI_PROVIDER_CAPABILITY_RECORDS.map((record) => [record.provider, record]));
+//#endregion
+//#region src/v6/maturity.ts
+/**
+* v6 capability maturity ladder — `M0`–`M5` (ADR 0001).
+*
+* ONE implementation of the maturity axis. `L0`–`L5` is the *finding
+* trust level* (`src/types.ts:106-117`) and is never a maturity value;
+* the two axes are orthogonal (ADR 0011). The blueprint's rejected
+* `EXPERIMENTAL→…→CERTIFIED` ladder is not declared anywhere, so the
+* product has exactly two level vocabularies, each with one meaning.
+*
+* Rules this module encodes, because they are the whole point of the
+* ladder and are otherwise only prose:
+*
+*  - Maturity is **granted by evidence, never by hand**. Promotion is a
+*    machine transition; there is no `setMaturity` export.
+*  - Every level below `M5` must expose a machine-readable
+*    `nextLevelGap`. `nextLevelGap` is therefore required, not optional,
+*    and a capability that cannot state its gap is a registry error.
+*  - Maturity can be **demoted automatically** when a `revisitTrigger`
+*    fires. That is the same rule the ecosystem census staleness trigger
+*    uses (ADR 0010), which is why the trigger is a first-class field
+*    here rather than a string on a doc.
+*  - `M4` requires precision AND recall, never precision alone (Law 5:
+*    precision must not hide poor recall, and recall must not hide poor
+*    precision).
+*  - `M5` is unreachable from inside the engine: it requires external
+*    field evidence (`REMOTE_PROVEN`), which the zero-network default
+*    never produces. A capability that claims `M5` without external
+*    evidence is a false proof, not a fast promotion.
+*/
+const MATURITY_LEVELS$1 = [
+	"M0_UNKNOWN",
+	"M1_DECLARED",
+	"M2_IMPLEMENTED",
+	"M3_FIXTURE_VERIFIED",
+	"M4_CORPUS_VERIFIED",
+	"M5_FIELD_PROVEN"
+];
+/** The short `M0`–`M5` form. Two vocabularies, one meaning each. */
+const MATURITY_SHORT = {
+	M0_UNKNOWN: "M0",
+	M1_DECLARED: "M1",
+	M2_IMPLEMENTED: "M2",
+	M3_FIXTURE_VERIFIED: "M3",
+	M4_CORPUS_VERIFIED: "M4",
+	M5_FIELD_PROVEN: "M5"
+};
+/** The default for anything unclassified. Never a guess upward. */
+const DEFAULT_MATURITY = "M0_UNKNOWN";
+const RANK = {
+	M0_UNKNOWN: 0,
+	M1_DECLARED: 1,
+	M2_IMPLEMENTED: 2,
+	M3_FIXTURE_VERIFIED: 3,
+	M4_CORPUS_VERIFIED: 4,
+	M5_FIELD_PROVEN: 5
+};
+function isMaturity(value) {
+	return typeof value === "string" && MATURITY_LEVELS$1.includes(value);
+}
+/** Unknown input ranks as `M0` — an unparseable claim is not a claim. */
+function maturityRank(value) {
+	return isMaturity(value) ? RANK[value] : RANK[DEFAULT_MATURITY];
+}
+/** The next level up, or `null` at the ceiling. */
+function nextMaturity(value) {
+	const rank = RANK[value];
+	return rank >= MATURITY_LEVELS$1.length - 1 ? null : MATURITY_LEVELS$1[rank + 1] ?? null;
+}
+MATURITY_LEVELS$1.filter((level) => level !== "M5_FIELD_PROVEN");
+/**
+* Derive maturity from evidence. **The only way a capability gets a
+* level** — there is no `setMaturity` export, and a hand-written level in
+* a registry is a defect, not a default.
+*
+* The rule is monotone: each level requires its own criterion *and* every
+* criterion below it. A capability with corpus proof but no fixtures
+* lands at `M2`, because `M4`'s criterion is a chain, not a ceiling — a
+* real corpus run without a deterministic fixture quad is exactly the
+* state that must not be advertised as `M4`.
+*/
+function deriveMaturityFromEvidence(evidence) {
+	if (evidence.fieldProven) return "M5_FIELD_PROVEN";
+	if (evidence.corpusVerified && evidence.fixtureQuadVerified && evidence.unitTested && evidence.implemented && evidence.declared) return "M4_CORPUS_VERIFIED";
+	if (evidence.fixtureQuadVerified && evidence.implemented && evidence.declared) return "M3_FIXTURE_VERIFIED";
+	if (evidence.implemented && evidence.unitTested && evidence.declared) return "M2_IMPLEMENTED";
+	if (evidence.declared) return "M1_DECLARED";
+	return "M0_UNKNOWN";
+}
+/**
+* Build the `nextLevelGap` for whatever the evidence currently supports.
+* `missing` is derived from the *unsatisfied* criteria of the next level
+* up, so a gap can never quietly go stale against the ladder.
+*/
+function nextLevelGapFromEvidence(evidence, owner, revisitTrigger) {
+	const maturity = deriveMaturityFromEvidence(evidence);
+	const target = nextMaturity(maturity);
+	if (target === null) return {
+		maturity,
+		nextLevelGap: null
+	};
+	const missing = [];
+	if (target === "M1_DECLARED" && !evidence.declared) missing.push("registry entry with an owner and a claim");
+	if (target === "M2_IMPLEMENTED") {
+		if (!evidence.implemented) missing.push("implementation exists");
+		if (!evidence.unitTested) missing.push("unit tests for the implementation");
+	}
+	if (target === "M3_FIXTURE_VERIFIED") {
+		if (!evidence.fixtureQuadVerified) missing.push("positive + negative + boundary + adversarial fixtures pass deterministically in CI");
+	}
+	if (target === "M4_CORPUS_VERIFIED") {
+		if (!evidence.corpusVerified) missing.push("real-repository corpus run, n >= 10 classified verdicts, Wilson CI recorded, precision AND recall measured, detectorRev locked");
+	}
+	if (target === "M5_FIELD_PROVEN") {
+		if (!evidence.fieldProven) missing.push("independent real-world repositories, declared field support, stable confidence interval, candidate-bound evidence");
+	}
+	return {
+		maturity,
+		nextLevelGap: {
+			target,
+			missing,
+			owner,
+			revisitTrigger
+		}
+	};
+}
+[
+	{
+		id: "trustLevel",
+		fields: ["trustLevel"],
+		vocabulary: [...TRUST_ORDER],
+		question: "How much do we trust this finding? (src/types.ts:106-117)"
+	},
+	{
+		id: "maturity",
+		fields: ["maturity"],
+		vocabulary: MATURITY_LEVELS$1,
+		question: "How much has this capability been proven? (ADR 0001)"
+	},
+	{
+		id: "evidenceState",
+		fields: ["evidenceState", "state"],
+		vocabulary: [
+			"FRESH",
+			"STALE",
+			"FOREIGN",
+			"NOT_RUN",
+			"PARTIAL",
+			"CONTRADICTORY",
+			"INVALID",
+			"UNKNOWN"
+		],
+		question: "Is this evidence current and admissible?"
+	},
+	{
+		id: "determination",
+		fields: ["determination", "verdict"],
+		vocabulary: [
+			"PASS",
+			"FAILED",
+			"BLOCKED",
+			"INCONCLUSIVE",
+			"UNPROVEN",
+			"PARTIAL"
+		],
+		question: "What is the verdict? (closed set, TRUST-CONSTITUTION §2)"
+	},
+	{
+		id: "lifecycle",
+		fields: ["lifecycle", "ruleStatus"],
+		vocabulary: [
+			"PROPOSED",
+			"EXPERIMENTAL",
+			"PROVISIONAL",
+			"VERIFIED",
+			"PROVEN",
+			"DEPRECATED",
+			"RETIRED"
+		],
+		question: "Where is this rule in its career?"
+	},
+	{
+		id: "severity",
+		fields: [
+			"severity",
+			"trustImpact",
+			"policySeverity"
+		],
+		vocabulary: [
+			"CRITICAL",
+			"HIGH",
+			"MEDIUM",
+			"LOW",
+			"INFO",
+			"NONE"
+		],
+		question: "How much does it matter? (technical severity stays separate)"
+	}
+].map((axis) => axis.id);
+//#endregion
+//#region src/v6/ecosystem-census.ts
+/**
+* The leading major of a version or range. `FRAMEWORK_INVENTORY`
+* records *validated versions* (`1.44`, `29`) while a manifest records a
+* *range* (`^29.7.0`); both sides normalise to a major so the staleness
+* trigger compares like with like. A trigger that fires on a
+* representation difference is a trigger people learn to ignore.
+*/
+function versionMajor(raw) {
+	const match = /\d+(?:\.\d+)*/.exec(raw);
+	if (!match) return null;
+	return (match[0] ?? "").split(".")[0] ?? null;
+}
+//#endregion
+//#region src/v6/ecosystem-probe.ts
+/**
+* Filesystem-backed census evidence + the discovery probe (ADR 0010).
+*
+* This module is the executable half of the census. Two jobs, both of
+* which exist because a census nobody diffs against reality is just a
+* nicer-looking hand-maintained list:
+*
+*  1. **Evidence resolution** — a `CensusEvidenceResolver` that observes
+*     the real checkout, so a census entry's maturity is *derived* from
+*     artifacts that exist rather than typed by a person. This is what
+*     makes D1 mechanical: a capability ships only at the maturity the
+*     machine proves.
+*
+*  2. **The discovery probe** — a walk over the checked-out corpus
+*     (`tests/corpus/.cache/`) that reports every QA tool it sees,
+*     including tools the census has never heard of. Those land as
+*     `UNRECOGNIZED`, which is a first-class signal: a new tool the
+*     engine sees in the wild and silently ignores is a release-blocking
+*     honesty failure, not a backlog item.
+*
+* The resolver is deliberately **conservative**. Where no machine gate
+* exists to prove a criterion, the resolver returns `false` and the
+* entry lands lower. That direction of error is the safe one: an
+* under-claim is honest, an over-claim is a false proof (Law 1). Every
+* `false` returned here is therefore a real, named Wave-4 gate that does
+* not exist yet — see the `nextLevelGap` each entry carries.
+*/
+const CORPUS_CACHE_DIR = join("tests", "corpus", ".cache");
+const FIXTURES_DIR = join("tests", "fixtures");
+const VERDICTS_DIR = join("tests", "corpus", "verdicts");
+const ADAPTERS_DIR = join("src", "adapters");
+const RULES_TESTS_DIR = join("tests", "rules");
+const ADAPTER_TESTS_DIR = join("tests", "adapters");
+/** `QA-PW-*` → `QA-PW`. The family prefix is the id's domain segment. */
+function ruleFamily$1(ruleId) {
+	const parts = ruleId.split("-");
+	return parts.length >= 2 ? `${parts[0]}-${parts[1]}` : ruleId;
+}
+/**
+* Census ids are `ec.<category>.<slug>`, so the rule family they map to
+* is derived from the slug. This mapping is the join key between the
+* census and the rule registry — ADR 0007 in practice: the census
+* projects the existing registry rather than restating it.
+*/
+const SLUG_TO_FAMILY = {
+	playwright: "QA-PW",
+	cypress: "QA-CYP",
+	selenium: "QA-SEL",
+	jest: "QA-JV",
+	vitest: "QA-JV",
+	mocha: "QA-JV",
+	jasmine: "QA-JV",
+	pytest: "QA-PY",
+	unittest: "QA-PY",
+	"github-actions": "QA-CI",
+	"azure-devops": "QA-CI",
+	jenkins: "QA-CI",
+	"gitlab-ci": "QA-CI",
+	typescript: "QA-TEST",
+	python: "QA-PY",
+	java: "QA-JV",
+	csharp: "QA-CS"
+};
+function familyForEntry(entry) {
+	const slug = entry.id.split(".").pop() ?? "";
+	return SLUG_TO_FAMILY[slug] ?? null;
+}
+function groupBy(ids) {
+	const map = /* @__PURE__ */ new Map();
+	for (const id of ids) {
+		const family = ruleFamily$1(id);
+		const bucket = map.get(family) ?? [];
+		bucket.push(id);
+		map.set(family, bucket);
+	}
+	return map;
+}
+function listFilesRecursive(dir, depth = 0) {
+	if (depth > 4 || !existsSync(dir)) return [];
+	const out = [];
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...listFilesRecursive(full, depth + 1));
+		else out.push(full);
+	}
+	return out;
+}
+/**
+* Build the evidence index from the real checkout. Pure with respect to
+* the census (it takes a root), so the same function serves the
+* generator, the gate and the test fixture.
+*/
+function buildRepoEvidenceIndex(root) {
+	const liveIds = RULES.map((rule) => rule.id);
+	const rulesByFamily = groupBy(liveIds);
+	const measured = [];
+	for (const rule of RULES) {
+		const measurement = MEASURED_FP[rule.id];
+		if (measurement && measurement.detectorRevision === declaredDetectorRevision(rule)) measured.push(rule.id);
+	}
+	const measuredByFamily = groupBy(measured);
+	const ruleSpecSources = listFilesRecursive(RULES_TESTS_DIR).filter((file) => file.endsWith(".ts")).map((file) => readFileSync(file, "utf8"));
+	const testedByFamily = groupBy(liveIds.filter((id) => ruleSpecSources.some((source) => source.includes(id))));
+	const quad = [];
+	if (existsSync(join(root, FIXTURES_DIR))) for (const id of liveIds) {
+		const dir = join(root, FIXTURES_DIR, id);
+		if (!existsSync(dir)) continue;
+		try {
+			if (listFilesRecursive(dir).length >= 4) quad.push(id);
+		} catch {}
+	}
+	const fixtureQuadByFamily = groupBy(quad);
+	const corpusVerdictsByFamily = /* @__PURE__ */ new Map();
+	const verdictsDir = join(root, VERDICTS_DIR);
+	if (existsSync(verdictsDir)) for (const file of readdirSync(verdictsDir)) {
+		if (!file.endsWith(".jsonl")) continue;
+		for (const line of readFileSync(join(verdictsDir, file), "utf8").split("\n")) {
+			if (!line.trim()) continue;
+			try {
+				const entry = JSON.parse(line);
+				if (!entry.ruleId) continue;
+				if (entry.verdict !== "TP" && entry.verdict !== "FP") continue;
+				const family = ruleFamily$1(entry.ruleId);
+				corpusVerdictsByFamily.set(family, (corpusVerdictsByFamily.get(family) ?? 0) + 1);
+			} catch {}
+		}
+	}
+	const adapters = /* @__PURE__ */ new Set();
+	const adapterDir = join(root, ADAPTERS_DIR);
+	if (existsSync(adapterDir)) {
+		for (const file of readdirSync(adapterDir)) if (file.endsWith(".ts")) adapters.add(file.replace(/\.ts$/, ""));
+	}
+	const adapterSpecNames = /* @__PURE__ */ new Set();
+	for (const dir of [ADAPTER_TESTS_DIR, join("tests", "frameworks")]) for (const file of listFilesRecursive(join(root, dir))) {
+		if (!file.endsWith(".spec.ts")) continue;
+		const source = readFileSync(file, "utf8");
+		for (const adapter of adapters) if (source.includes(adapter)) adapterSpecNames.add(adapter);
+	}
+	const corpusRoot = join(root, CORPUS_CACHE_DIR);
+	return {
+		rulesByFamily,
+		measuredByFamily,
+		testedByFamily,
+		fixtureQuadByFamily,
+		corpusVerdictsByFamily,
+		adapters,
+		adapterSpecNames,
+		corpusRepos: existsSync(corpusRoot) ? readdirSync(corpusRoot).filter((name) => {
+			try {
+				return statSync(join(corpusRoot, name)).isDirectory();
+			} catch {
+				return false;
+			}
+		}) : []
+	};
+}
+/**
+* Build the resolver from the index. Every arm is conservative and each
+* `false` is a *named missing gate*, not an oversight — see the comments.
+*/
+function createEvidenceResolver(index, root) {
+	return {
+		adapterExists(entry) {
+			const family = familyForEntry(entry);
+			if (family && (index.rulesByFamily.get(family)?.length ?? 0) > 0) return true;
+			const slug = entry.id.split(".").pop() ?? "";
+			return index.adapters.has(slug);
+		},
+		unitTested(entry) {
+			const family = familyForEntry(entry);
+			if (family && (index.testedByFamily.get(family)?.length ?? 0) > 0) return true;
+			const slug = entry.id.split(".").pop() ?? "";
+			return index.adapterSpecNames.has(slug);
+		},
+		fixtureQuadVerified() {
+			return false;
+		},
+		corpusVerified() {
+			return false;
+		},
+		fieldProven() {
+			return false;
+		},
+		observedUpstreamMajor(entry) {
+			return detectUpstreamMajor(entry, root);
+		}
+	};
+}
+/**
+* The npm package name(s) a census slug corresponds to, if any.
+*
+* Read from the entry's own `upstreamPackages` — the census is the
+* authority on naming, so a consumer holding its own copy of the answer
+* is the parallel-inventory drift ADR 0007 exists to prevent. An earlier
+* version kept a local map here and a heuristic on the slug, and the
+* consequence was concrete: `@percy/cypress` was read as `cypress` and
+* `@swc/jest` as `jest`, inventing staleness verdicts for plugins whose
+* versions do not track the runner.
+*/
+function npmPackageNames(entry) {
+	return entry.upstreamPackages.filter((pkg) => pkg.ecosystem === "npm" || pkg.ecosystem === "any").map((pkg) => pkg.name);
+}
+/**
+* Detect the upstream major version a corpus repository actually uses,
+* when it is discoverable from a manifest. Returns `null` when it is not
+* — and `null` means "no staleness verdict", never "up to date".
+*/
+function detectUpstreamMajor(entry, root) {
+	if (entry.handledUpstreamMajors.length === 0) return null;
+	const upstream = npmPackageNames(entry);
+	if (upstream.length === 0) return null;
+	for (const repo of corpusReposOf(root)) {
+		const pkgPath = join(root, CORPUS_CACHE_DIR, repo, "package.json");
+		if (!existsSync(pkgPath)) continue;
+		try {
+			const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+			const deps = {
+				...pkg.dependencies ?? {},
+				...pkg.devDependencies ?? {},
+				...pkg.peerDependencies ?? {}
+			};
+			for (const name of upstream) {
+				const range = deps[name];
+				if (range === void 0) continue;
+				const major = versionMajor(range);
+				if (major !== null) return major;
+			}
+		} catch {}
+	}
+	return null;
+}
+function corpusReposOf(root) {
+	const corpusRoot = join(root, CORPUS_CACHE_DIR);
+	if (!existsSync(corpusRoot)) return [];
+	return readdirSync(corpusRoot).filter((name) => {
+		try {
+			return statSync(join(corpusRoot, name)).isDirectory();
+		} catch {
+			return false;
+		}
+	});
+}
+//#endregion
+//#region src/v6/capability-registry.ts
+/**
+
+}
+
+/**
+* The unified capability registry (ADR 0007) — Wave 1.
+*
+* **One registry, never a parallel one.** Before this module the
+* repository held six capability-adjacent primitives (framework
+* inventory, provider capability contract, universal pack contract, rule
+* registry census, the 136-cell support matrix, `src/capabilities.ts`), and
+* none of them agreed with the others. That is the drift Law 8 exists to
+* prevent, and it is why a hand-maintained support list is a documentation
+* defect *by construction* rather than by negligence.
+*
+* This module is the **loader**. It reads from the existing primitives and
+* assembles one entry per capability. It deliberately does not:
+*
+*  - re-declare any framework, provider, language or rule list;
+*  - contain a `setMaturity` export (maturity is derived — ADR 0001);
+*  - let a consumer hand-write a claim (every claim resolves to a
+*    `ProofRef`, and `claim-registry` is the only place a claim lives).
+*
+* A **capability id is not a rule id.** Capability ids live in this
+* namespace and *reference* `QA-*` ids, which are frozen forever
+* (ADR 0003). A capability is a claim about coverage; a rule is a
+* detector. Collapsing them would forbid the one-capability-several-rules
+* case that already exists.
+*
+* The 136-cell support matrix becomes a **projection** of this registry
+* rather than a second truth (§2.3), which is what makes a matrix cell
+* impossible to disagree with a capability entry.
+*/
+function isRuleId(value) {
+	return typeof value === "string" && /^QA-[A-Z]+-\d+$/.test(value);
+}
+const BLIND_EVIDENCE = {
+	hasLiveRule: false,
+	hasMeasurement: false,
+	hasAdapter: false,
+	hasFixtureQuad: false,
+	hasCorpusMeasurement: false,
+	hasFieldEvidence: false
+};
+function toMaturityEvidence(e) {
+	return {
+		declared: true,
+		implemented: e.hasLiveRule || e.hasAdapter,
+		unitTested: e.hasLiveRule,
+		fixtureQuadVerified: e.hasFixtureQuad,
+		corpusVerified: e.hasCorpusMeasurement,
+		fieldProven: e.hasFieldEvidence
+	};
+}
+const BLIND_REGISTRY_EVIDENCE = {
+	registry: BLIND_EVIDENCE,
+	files: {
+		adapterExists: () => false,
+		fixtureQuadExists: () => false,
+		observedUpstreamMajor: () => null
+	}
+};
+function ruleFamily(ruleId) {
+	const parts = ruleId.split("-");
+	return parts.length >= 2 ? `${parts[0]}-${parts[1]}` : ruleId;
+}
+function collectRuleFacts() {
+	const group = (ids) => {
+		const map = /* @__PURE__ */ new Map();
+		for (const id of ids) {
+			const family = ruleFamily(id);
+			const bucket = map.get(family) ?? [];
+			bucket.push(id);
+			map.set(family, bucket);
+		}
+		return map;
+	};
+	const live = RULES.map((rule) => rule.id);
+	const measured = RULES.filter((rule) => {
+		const measurement = MEASURED_FP[rule.id];
+		return measurement !== void 0 && measurement.detectorRevision === declaredDetectorRevision(rule);
+	}).map((rule) => rule.id);
+	return {
+		liveByFamily: group(live),
+		measuredByFamily: group(measured),
+		tierByFamily: group(live.map((id) => effectiveTier(getRuleById(id)))),
+		retired: new Set(RETIRED_RULE_IDS)
+	};
+}
+function getRuleById(id) {
+	const rule = RULES.find((candidate) => candidate.id === id);
+	if (rule === void 0) throw new Error(`rule ${id} is in the registry index but not in RULES`);
+	return rule;
+}
+/**
+* The framework-inventory id becomes a capability id in the
+* `test.framework.*` / `test.runner.*` namespace. The mapping is a pure
+* function of the inventory row, so a framework added to the inventory
+* appears in the registry without anybody typing its name a second time.
+*/
+function frameworkCapabilityId(frameworkId) {
+	return `test.framework.${frameworkId.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "")}`;
+}
+function providerCapabilityId(provider) {
+	return `ci.provider.${provider.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "")}`;
+}
+function domainCapabilityId(domainId) {
+	return `qa.domain.${domainId.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "")}`;
+}
+function finalize(base, evidence, observedAt) {
+	const { maturity, nextLevelGap } = nextLevelGapFromEvidence(toMaturityEvidence(evidence.registry), base.owner, `capability ${base.id} gains evidence for its next level`);
+	return {
+		...base,
+		proven: maturity,
+		maturity,
+		nextLevelGap,
+		proof: proofFor(base, maturity, evidence, observedAt, collectRuleFacts())
+	};
+}
+/**
+* The proof pointer.
+*
+* **Only a measured rule can carry `LOCAL_PROVEN`.** An adapter file on
+* disk proves the capability is *implemented*, which is M2, but it is not
+* an observation: nobody recorded when it was checked, against which
+* revision, with what result. Promoting it to `LOCAL_PROVEN` would be the
+* precise failure the wave-1 DoD forbids — "no capability advertised
+* above proven level" — and it is why the honest answer for most entries
+* today is `BLOCKED`.
+*
+* That `BLOCKED` is not a gap in this module. It is the measurement that
+* Wave 4 produces: a per-capability `detectorRev` binding with a recorded
+* observation date. Until then, every claim being unbound is the truth
+* (`GAP-V6-006`), and `claim-registry.json` shows exactly that.
+*/
+function proofFor(base, maturity, evidence, observedAt, facts) {
+	if (maturityRank(maturity) >= maturityRank("M2_IMPLEMENTED")) {
+		const measured = evidence.registry.hasMeasurement ? base.rules.find((rule) => !facts.retired.has(rule)) : void 0;
+		if (measured !== void 0 && observedAt !== "") return {
+			status: "LOCAL_PROVEN",
+			artifact: `docs/FP-AUDIT.md#${measured}`,
+			digest: null,
+			observedAt,
+			authority: base.owner
+		};
+	}
+	return {
+		status: "BLOCKED",
+		artifact: null,
+		digest: null,
+		observedAt: null,
+		authority: "NONE"
+	};
+}
+/**
+* Build the registry. The result is a function of the checkout plus the
+* supplied evidence, and of nothing else — which is what makes
+* `docs/capability-registry.json` byte-stable for a commit.
+*/
+function buildCapabilityRegistry(options = {}) {
+	const root = options.root ?? process.cwd();
+	const evidence = options.evidence ?? BLIND_REGISTRY_EVIDENCE;
+	const observedAt = options.observedAt ?? "1970-01-01";
+	const facts = collectRuleFacts();
+	const byId = /* @__PURE__ */ new Map();
+	for (const framework of FRAMEWORK_INVENTORY) {
+		if (framework.entityType === "CI_PROVIDER") continue;
+		const id = frameworkCapabilityId(framework.frameworkId);
+		const family = familyForFramework(framework.frameworkId);
+		const live = facts.liveByFamily.get(family) ?? [];
+		const adapter = framework.executorAdapterIds.length > 0 ? `src/adapters/${framework.executorAdapterIds[0]}.ts` : null;
+		byId.set(id, finalize({
+			id,
+			name: framework.frameworkId,
+			kind: kindForFramework(framework.entityType),
+			owner: "framework-inventory",
+			rules: live,
+			censusId: null,
+			frameworkId: framework.frameworkId,
+			domains: [],
+			blocksAxes: ["Discovery"],
+			observedUpstreamMajor: evidence.files.observedUpstreamMajor(framework.frameworkId),
+			adapter
+		}, {
+			registry: {
+				...evidence.registry,
+				hasAdapter: evidence.registry.hasAdapter || adapter !== null,
+				hasFixtureQuad: evidence.registry.hasFixtureQuad || live.some((rule) => evidence.files.fixtureQuadExists(rule))
+			},
+			files: evidence.files
+		}, observedAt));
+	}
+	for (const provider of CI_PROVIDER_IDS) {
+		const id = providerCapabilityId(provider);
+		if (byId.has(id)) continue;
+		const live = facts.liveByFamily.get("QA-CI") ?? [];
+		const adapter = `src/adapters/${provider.toLowerCase().replace(/[^a-z0-9]+/g, "-")}.ts`;
+		byId.set(id, finalize({
+			id,
+			name: provider,
+			kind: "ci-cd-provider",
+			owner: "provider-capability-contract",
+			rules: live,
+			censusId: null,
+			frameworkId: null,
+			domains: ["ci-integrity"],
+			blocksAxes: ["CI Integrity", "False-Green Detection"],
+			observedUpstreamMajor: null,
+			adapter
+		}, {
+			registry: {
+				...evidence.registry,
+				hasAdapter: evidence.registry.hasAdapter || evidence.files.adapterExists(adapter),
+				hasFixtureQuad: evidence.registry.hasFixtureQuad || live.some((rule) => evidence.files.fixtureQuadExists(rule))
+			},
+			files: evidence.files
+		}, observedAt));
+	}
+	for (const domain of readDomainCells(root)) {
+		const id = domainCapabilityId(domain.id);
+		if (byId.has(id)) continue;
+		byId.set(id, finalize({
+			id,
+			name: domain.label,
+			kind: "domain",
+			owner: domain.owner,
+			rules: [],
+			censusId: null,
+			frameworkId: null,
+			domains: [domain.id],
+			blocksAxes: ["Domain Coverage"],
+			observedUpstreamMajor: null,
+			adapter: null,
+			declaredDisposition: domain.disposition,
+			blockedReason: domain.blockedReason,
+			revisitTrigger: domain.revisitTrigger
+		}, {
+			registry: BLIND_EVIDENCE,
+			files: evidence.files
+		}, observedAt));
+	}
+	return {
+		schemaVersion: 1,
+		registryId: "mjolnir-capability-registry",
+		observedAt,
+		entries: [...byId.values()].sort((a, b) => compareCodePoints(a.id, b.id))
+	};
+}
+const FRAMEWORK_FAMILY = {
+	playwright: "QA-PW",
+	cypress: "QA-CYP",
+	selenium: "QA-SEL",
+	jest: "QA-JV",
+	vitest: "QA-JV",
+	mocha: "QA-JV",
+	jasmine: "QA-JV",
+	pytest: "QA-PY",
+	typescript: "QA-TEST",
+	"github-actions": "QA-CI",
+	"azure-pipelines": "QA-CI",
+	jenkins: "QA-CI",
+	"gitlab-ci": "QA-CI"
+};
+/** The rule family a framework's capability is evidenced by. */
+function familyForFramework(frameworkId) {
+	return FRAMEWORK_FAMILY[frameworkId] ?? "QA-TEST";
+}
+function kindForFramework(entityType) {
+	switch (entityType) {
+		case "E2E_FRAMEWORK": return "test-framework";
+		case "AUTOMATION_LIBRARY": return "test-runner";
+		default: return "test-framework";
+	}
+}
+/**
+* Read the `MATRIX-DOMAIN-*` cells from the support matrix.
+*
+* Returns an empty list when the matrix is absent rather than throwing: a
+* missing ledger means "no domain claims are derivable", which is a gap the
+* gate reports — not a crash in the middle of building a registry.
+*/
+function readDomainCells(root = process.cwd()) {
+	const path = join(root, "docs", "M26-SUPPORT-MATRIX.json");
+	if (!existsSync(path)) return [];
+	let cells;
+	try {
+		cells = JSON.parse(readFileSync(path, "utf8")).cells ?? [];
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const cell of cells) {
+		const cellId = typeof cell.cell_id === "string" ? cell.cell_id : "";
+		if (!cellId.startsWith("MATRIX-DOMAIN-")) continue;
+		const id = cellId.slice(14);
+		if (id === "") continue;
+		out.push({
+			id,
+			label: typeof cell.cell === "string" ? cell.cell : id,
+			disposition: typeof cell.disposition === "string" ? cell.disposition : "UNKNOWN",
+			owner: typeof cell.owner === "string" ? cell.owner : "unowned",
+			blockedReason: typeof cell.blocked_reason === "string" ? cell.blocked_reason : null,
+			revisitTrigger: typeof cell.revisit_trigger === "string" ? cell.revisit_trigger : null
+		});
+	}
+	return out.sort((a, b) => compareCodePoints(a.id, b.id));
+}
+/**
+* Evidence resolved against the real working tree.
+*
+* `hasLiveRule` and `hasMeasurement` come from the **rule registry**, not
+* from the filesystem, and they are read here rather than inside the
+* builder so that a test can inject an evidence object and have it mean
+* something. That matters: an earlier version of the builder read the
+* rule facts itself and only honoured the *capability-level* arms from its
+* caller, so a test that injected "no measurement" still saw
+* `LOCAL_PROVEN`. An evidence seam that silently ignores half of itself is
+* not a seam.
+*
+* The `hasCorpusMeasurement` arm is **always false** here, because nothing
+* binds a *capability* to a locked `detectorRev` yet — that is Wave 4's
+* `rules:quality:check`. A capability claiming M4 on the strength of a
+* per-rule measurement is exactly the false proof ADR 0001 forbids, so
+* M3/M4 stay unreachable until the per-capability gate exists.
+*/
+function realCapabilityEvidence() {
+	const probe = createEvidenceResolver(buildRepoEvidenceIndex(process.cwd()), process.cwd());
+	const facts = collectRuleFacts();
+	const measured = new Set([...facts.measuredByFamily.values()].flat());
+	return {
+		registry: {
+			hasLiveRule: new Set([...facts.liveByFamily.values()].flat()).size > 0,
+			hasMeasurement: measured.size > 0,
+			hasAdapter: false,
+			hasFixtureQuad: false,
+			hasCorpusMeasurement: false,
+			hasFieldEvidence: false
+		},
+		files: {
+			adapterExists: (relPath) => {
+				const slug = relPath.replace(/^src\/adapters\//, "").replace(/\.ts$/, "");
+				return probe.adapterExists(adapterProbeEntry(slug));
+			},
+			fixtureQuadExists: () => fixtureQuadExists(),
+			observedUpstreamMajor: (frameworkId) => probe.observedUpstreamMajor(adapterProbeEntry(frameworkId))
+		}
+	};
+}
+function adapterProbeEntry(slug) {
+	return {
+		id: `ec.test-framework.${slug}`,
+		name: slug,
+		category: "test-framework",
+		state: "SUPPORTED",
+		owner: "capability-registry",
+		observedAt: "1970-01-01",
+		signals: [],
+		adapter: `src/adapters/${slug}.ts`,
+		blocksAxes: [],
+		successor: null,
+		removalDate: null,
+		notApplicableReason: null,
+		upstreamPackages: [{
+			ecosystem: "npm",
+			name: slug
+		}],
+		handledUpstreamMajors: [],
+		revisitTrigger: "",
+		maturity: "M1_DECLARED",
+		nextLevelGap: null
+	};
+}
+/**
+* A per-rule fixture quad is a real filesystem question, and the answer
+* here is deliberately **no**: the repository's fixture directories are a
+* proxy, and a proxy must not buy an M3 claim (Law 1). Wave 4 ships the
+* real gate.
+*/
+function fixtureQuadExists() {
+	return false;
+}
+/**
+* `registry:check` — the Wave 1 DoD gate.
+*
+* The single most important rule here is **no capability advertised above
+* proven level**. A capability whose `maturity` outranks what its own
+* evidence supports is a false proof, and this is the function every
+* surface calls before it renders a maturity badge.
+*/
+function validateRegistry(registry) {
+	const diagnostics = [];
+	const seen = /* @__PURE__ */ new Set();
+	const liveIds = new Set(RULES.map((rule) => rule.id));
+	const retired = new Set(RETIRED_RULE_IDS);
+	for (const entry of registry.entries) {
+		if (seen.has(entry.id)) diagnostics.push({
+			code: "DUPLICATE_ID",
+			entryId: entry.id,
+			message: "duplicate capability id"
+		});
+		seen.add(entry.id);
+		if (entry.owner.trim() === "") diagnostics.push({
+			code: "MISSING_OWNER",
+			entryId: entry.id,
+			message: "capability has no named owner"
+		});
+		for (const reference of entry.rules) {
+			const rule = reference;
+			if (!isRuleId(rule)) diagnostics.push({
+				code: "UNKNOWN_RULE_REFERENCE",
+				entryId: entry.id,
+				message: `rule reference "${String(rule)}" is not a QA-* rule id (ADR 0003)`
+			});
+			else if (retired.has(rule)) diagnostics.push({
+				code: "RETIRED_RULE_REFERENCE",
+				entryId: entry.id,
+				message: `depends on retired rule ${rule}`
+			});
+			else if (!liveIds.has(rule)) diagnostics.push({
+				code: "UNKNOWN_RULE_REFERENCE",
+				entryId: entry.id,
+				message: `rule reference "${rule}" is not in the live registry`
+			});
+		}
+		if (maturityRank(entry.maturity) > maturityRank(entry.proven)) diagnostics.push({
+			code: "OVER_CLAIMED_MATURITY",
+			entryId: entry.id,
+			message: `advertises ${entry.maturity} but its own evidence proves only ${entry.proven}`
+		});
+		if (entry.nextLevelGap === null && entry.maturity !== "M5_FIELD_PROVEN") diagnostics.push({
+			code: "MISSING_NEXT_LEVEL_GAP",
+			entryId: entry.id,
+			message: `${entry.maturity} must expose a nextLevelGap (D1)`
+		});
+		if (entry.proof.status !== "BLOCKED" && (entry.proof.artifact === null || entry.proof.observedAt === null)) diagnostics.push({
+			code: "PROOF_WITHOUT_ARTIFACT",
+			entryId: entry.id,
+			message: `proof status ${entry.proof.status} requires both an artifact and an observedAt`
+		});
+	}
+	return diagnostics;
+}
+//#endregion
+//#region src/commands/capability.ts
+/** Parse the flags. Anything flag-shaped that is not documented is a
+*  usage error rather than a silently ignored argument, because
+*  `capability --promote-m3` must not read as "show me everything". */
+function parseCapabilityArgs(argv) {
+	const allowed = /* @__PURE__ */ new Set([
+		"--json",
+		"--kind",
+		"--maturity",
+		"--id"
+	]);
+	const unknown = [];
+	const query = {
+		kind: null,
+		maturity: null,
+		id: null
+	};
+	let json = false;
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index] ?? "";
+		if (!arg.startsWith("-")) {
+			unknown.push(arg);
+			continue;
+		}
+		const [flag, inlineValue] = arg.includes("=") ? [arg.slice(0, arg.indexOf("=")), arg.slice(arg.indexOf("=") + 1)] : [arg, void 0];
+		if (!allowed.has(flag)) {
+			unknown.push(arg);
+			continue;
+		}
+		if (flag === "--json") {
+			json = true;
+			continue;
+		}
+		const value = inlineValue ?? argv[index + 1] ?? "";
+		if (inlineValue === void 0) index += 1;
+		if (flag === "--kind") query.kind = value;
+		if (flag === "--maturity") query.maturity = value;
+		if (flag === "--id") query.id = value;
+	}
+	return {
+		query,
+		json,
+		unknown
+	};
+}
+function selectCapabilities(entries, query) {
+	return entries.filter((entry) => {
+		if (query.id !== null && !entry.id.includes(query.id)) return false;
+		if (query.kind !== null && entry.kind !== query.kind) return false;
+		if (query.maturity !== null && MATURITY_SHORT[entry.maturity] !== query.maturity.toUpperCase()) return false;
+		return true;
+	});
+}
+function capabilityJson(entries, diagnostics) {
+	return JSON.stringify({
+		contract: "mjolnir.capability.v1",
+		count: entries.length,
+		capabilities: entries.map((entry) => ({
+			capabilityId: entry.id,
+			name: entry.name,
+			kind: entry.kind,
+			owner: entry.owner,
+			maturity: MATURITY_SHORT[entry.maturity],
+			rules: entry.rules,
+			adapter: entry.adapter,
+			proof: entry.proof,
+			nextLevelGap: entry.nextLevelGap,
+			blocksAxes: entry.blocksAxes
+		})),
+		violations: diagnostics.map((d) => ({
+			code: d.code,
+			capabilityId: d.entryId,
+			message: d.message
+		}))
+	}, null, 2) + "\n";
+}
+function renderCapabilityText(entries, diagnostics) {
+	const lines = [
+		"Mjolnir capability registry",
+		"",
+		"Maturity is derived from evidence and cannot be set here. A capability is",
+		"shown at the level the machine can prove, or not shown at all.",
+		""
+	];
+	for (const entry of entries) {
+		lines.push(`${entry.id}  [${MATURITY_SHORT[entry.maturity]}]`);
+		lines.push(`  kind        ${entry.kind}`);
+		lines.push(`  owner       ${entry.owner}`);
+		if (entry.rules.length > 0) lines.push(`  rules       ${entry.rules.join(", ")}`);
+		if (entry.adapter !== null) lines.push(`  adapter     ${entry.adapter}`);
+		lines.push(`  proof       ${entry.proof.status}${entry.proof.artifact === null ? "" : ` (${entry.proof.artifact})`}`);
+		if (entry.nextLevelGap !== null) {
+			lines.push(`  next level  ${entry.nextLevelGap.target}`);
+			for (const missing of entry.nextLevelGap.missing) lines.push(`              - ${missing}`);
+		}
+		lines.push("");
+	}
+	if (diagnostics.length > 0) {
+		lines.push(`${diagnostics.length} violation(s):`);
+		for (const diagnostic of diagnostics) lines.push(`  ${diagnostic.code} ${diagnostic.entryId}: ${diagnostic.message}`);
+	} else lines.push("No violations: no capability is advertised above its proven level.");
+	return lines.join("\n");
+}
+function runCapabilityCommand(argv, io = {
+	out,
+	err
+}) {
+	const { query, json, unknown } = parseCapabilityArgs(argv);
+	if (unknown.length > 0) {
+		io.err(`capability: unknown argument ${unknown[0] ?? ""}\n`);
+		io.err("  usage: mjolnir capability [--json] [--kind <k>] [--maturity M0..M5] [--id <substring>]\n");
+		io.err("  note: there is deliberately no --set or --promote. Maturity is derived\n        from evidence, so it cannot be edited here.\n");
+		return 10;
+	}
+	const registry = buildCapabilityRegistry({ evidence: realCapabilityEvidence() });
+	const diagnostics = validateRegistry(registry);
+	const entries = selectCapabilities(registry.entries, query);
+	io.out(json ? capabilityJson(entries, diagnostics) : `${renderCapabilityText(entries, diagnostics)}\n`);
+	return diagnostics.length > 0 ? 1 : 0;
+}
+//#endregion
 //#region src/commands/maturity.ts
 /**
 * `mjolnir maturity` — organizational QA-maturity signals.
@@ -12249,6 +13596,7 @@ function runMaturityCommand(argv, io) {
 			return 20;
 		}
 	}
+	if (subcommand === "capabilities") return runCapabilityCommand(argv.slice(1), io);
 	io.err(`Unknown maturity subcommand: ${subcommand}`);
 	return 10;
 }
@@ -12309,6 +13657,18 @@ const CLI_COMMAND_NAMES = [
 const CLI_NON_SCAN_COMMANDS = new Set(CLI_COMMAND_NAMES.filter((command) => command !== "scan"));
 //#endregion
 //#region src/engine/cross-file.ts
+/**
+* Cross-file analysis (Upgrade-Plan-v3 Phase 6, tier-3 item #2).
+*
+* First cross-file signal: duplicate test names across files in the same
+* suite. A duplicated test name means two tests report under one label —
+* CI dashboards, flake trackers, and forensics all conflate them. This is
+* undetectable per-file by design (each file alone is consistent), which
+* is exactly why it belongs in a cross-file pass.
+*
+* Pure function over discovered test files: no I/O beyond what the caller
+* already read; deterministic output ordered by first occurrence.
+*/
 const JS_TEST_NAME_RE = /\b(?:test|it)\s*\(\s*['"`]([^'"`]+)['"`]\s*,/g;
 const PY_TEST_NAME_RE = /^def\s+(test_\w+)\s*\(/gm;
 /** Collect declared test names from one file's text. */
@@ -12340,7 +13700,7 @@ function findDuplicateTestNames(files) {
 		name,
 		files: [...filesSet].sort()
 	});
-	return out.sort((a, b) => a.name.localeCompare(b.name));
+	return out.sort((a, b) => compareCodePoints(a.name, b.name));
 }
 //#endregion
 //#region src/engine/cross-file-analysis.ts
@@ -12349,7 +13709,7 @@ function findDuplicateTestNames(files) {
 * Pure function — same input always produces same output.
 */
 function analyzeCrossFileSignals(files, findings, root) {
-	const orderedFiles = [...files].sort((a, b) => a.path.localeCompare(b.path));
+	const orderedFiles = [...files].sort((a, b) => compareCodePoints(a.path, b.path));
 	const duplicateTestNames = findDuplicateTestNames(orderedFiles).map((dup) => ({
 		type: "duplicate-test-name",
 		files: dup.files,
@@ -12402,7 +13762,7 @@ function detectSharedImports(files) {
 		files: [...paths].sort(),
 		message: `Module "${module}" imported by ${paths.size} files`
 	});
-	return out.sort((a, b) => a.message.localeCompare(b.message));
+	return out.sort((a, b) => compareCodePoints(a.message, b.message));
 }
 function detectCircularDependencies(files) {
 	const importMap = /* @__PURE__ */ new Map();
@@ -14016,9 +15376,6 @@ function renderTrustTrend(trend) {
 * be derivable from the scan result, and every derivation must
 * be deterministic.
 */
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function optionalDeepEqual(actual, expected) {
 	return actual === void 0 && expected === void 0 ? true : isDeepStrictEqual(actual, expected);
 }
@@ -14031,7 +15388,7 @@ function verifyMachineContract(result, contract = buildMachineContract(result))
 	const violations = [];
 	const checks = [];
 	const expected = buildMachineContract(result);
-	const contractRecord = isRecord$1(contract) ? contract : Object.create(null);
+	const contractRecord = isRecord(contract) ? contract : Object.create(null);
 	const contractVersion = typeof contractRecord.contractVersion === "number" ? contractRecord.contractVersion : 0;
 	const versionMatches = contractVersion === 1;
 	if (!versionMatches) violations.push(`Unsupported contract version ${contractVersion}`);
@@ -14041,7 +15398,7 @@ function verifyMachineContract(result, contract = buildMachineContract(result))
 		detail: versionMatches ? `Contract version ${contractVersion} confirmed` : `Unsupported contract version ${contractVersion}`
 	});
 	const suppliedSummary = contractRecord.summary;
-	const digestMatch = isRecord$1(suppliedSummary) && suppliedSummary.digest === expected.summary.digest;
+	const digestMatch = isRecord(suppliedSummary) && suppliedSummary.digest === expected.summary.digest;
 	if (!digestMatch) violations.push("Machine contract digest mismatch");
 	checks.push({
 		name: "digest-integrity",
@@ -14136,7 +15493,7 @@ function verifyEvidenceIntegrity(result) {
 }
 function verifyCompleteness(result, completeness, expected) {
 	const violations = [];
-	if (!isRecord$1(completeness)) return ["Missing completeness"];
+	if (!isRecord(completeness)) return ["Missing completeness"];
 	const supplied = completeness;
 	if (supplied.partial !== result.partial) violations.push("Partial flag mismatch");
 	if (!isDeepStrictEqual(supplied, expected)) violations.push("Completeness projection mismatch");
@@ -14180,6 +15537,13 @@ function renderContractVerification(result) {
 * Deterministic sha256 fingerprint of the suppression set. Canonical
 * JSON sorted by ruleId+files+reason+expires so order in the config
 * file does not affect the hash.
+*
+* Code-unit order on the ruleId, not an ambient `localeCompare`: the sorted
+* array is serialized into the hash, so a locale-dependent collation would
+* make the SAME suppression file produce two different fingerprints on two
+* machines — and that fingerprint is what tells a reader their suppressions
+* changed. (Line 55 keeps a bare `.sort()`: that is `Array.prototype.sort`'s
+* own code-unit default, which is already locale-free.)
 */
 function suppressionFingerprint(suppressions) {
 	const canonical = suppressions.map((s) => ({
@@ -14187,7 +15551,7 @@ function suppressionFingerprint(suppressions) {
 		files: [...s.files ?? []].sort(),
 		reason: s.reason,
 		...s.expires !== void 0 ? { expires: s.expires } : {}
-	})).sort((a, b) => a.ruleId.localeCompare(b.ruleId));
+	})).sort((a, b) => compareCodePoints(a.ruleId, b.ruleId));
 	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 /**
@@ -14349,9 +15713,6 @@ const GITLAB_RESERVED_KEYS = /* @__PURE__ */ new Set([
 	"variables",
 	"workflow"
 ]);
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function conditionState(value) {
 	if (value === void 0 || value === null || value === true) return "active";
 	if (value === false) return "disabled";
@@ -15002,7 +16363,7 @@ async function runMilestoneScan(args, io, readSources, strict = false) {
 				readSkipped++;
 			}
 		}
-		files.sort((left, right) => left.path.localeCompare(right.path));
+		files.sort((left, right) => compareCodePoints(left.path, right.path));
 	}
 	return {
 		result,
@@ -15043,7 +16404,7 @@ function loadPolicy(path) {
 	}
 	let record;
 	try {
-		record = parseJsonFile(text, path, isRecord$3);
+		record = parseJsonFile(text, path, isRecord);
 	} catch (error) {
 		throw new ConfigValidationError(`invalid suppression policy: ${path}`, { cause: error });
 	}
@@ -15062,7 +16423,7 @@ function loadPolicy(path) {
 	};
 }
 function isTrustSnapshot(value) {
-	return isRecord$3(value) && typeof value.scanId === "string" && typeof value.timestamp === "string" && (typeof value.score === "number" || value.score === null) && typeof value.findings === "number" && typeof value.errors === "number" && typeof value.warnings === "number" && typeof value.infos === "number" && typeof value.advisory === "number" && typeof value.trustLevel === "string" && typeof value.confidence === "number" && typeof value.evidenceCoverage === "number" && typeof value.inconclusiveRate === "number" && typeof value.partial === "boolean" && typeof value.frameworkCount === "number" && typeof value.ruleCount === "number";
+	return isRecord(value) && typeof value.scanId === "string" && typeof value.timestamp === "string" && (typeof value.score === "number" || value.score === null) && typeof value.findings === "number" && typeof value.errors === "number" && typeof value.warnings === "number" && typeof value.infos === "number" && typeof value.advisory === "number" && typeof value.trustLevel === "string" && typeof value.confidence === "number" && typeof value.evidenceCoverage === "number" && typeof value.inconclusiveRate === "number" && typeof value.partial === "boolean" && typeof value.frameworkCount === "number" && typeof value.ruleCount === "number";
 }
 function loadTrustHistory(path) {
 	if (!existsSync(path)) return [];
@@ -15088,46 +16449,46 @@ function isStringArray(value) {
 	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
 function isValidAnalysisStatus(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return (value.discovery === "complete" || value.discovery === "partial") && (value.rules === "complete" || value.rules === "partial") && isNonNegativeInteger(value.skippedFiles) && isFiniteNumber(value.durationMs) && value.durationMs >= 0 && (value.truncationReasons === void 0 || isStringArray(value.truncationReasons)) && (value.rulesCrashed === void 0 || isNonNegativeInteger(value.rulesCrashed));
 }
 function isValidDimension(value) {
-	return isRecord$3(value) && typeof value.category === "string" && isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100 && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos);
+	return isRecord(value) && typeof value.category === "string" && isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100 && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos);
 }
 function isValidFinding(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return typeof value.ruleId === "string" && value.ruleId.length > 0 && typeof value.category === "string" && typeof value.file === "string" && value.file.length > 0 && isPositiveInteger(value.line) && isPositiveInteger(value.column) && typeof value.message === "string" && value.message.length > 0 && typeof value.severity === "string" && typeof value.confidence === "string" && typeof value.findingType === "string" && typeof value.qaImpact === "string" && typeof value.why === "string" && typeof value.fix === "string";
 }
 function isValidTrustSummary(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return TRUST_ORDER.includes(String(value.level)) && isFiniteNumber(value.confidence) && value.confidence >= 0 && value.confidence <= 1 && isFiniteNumber(value.evidenceCoverage) && value.evidenceCoverage >= 0 && value.evidenceCoverage <= 1 && isFiniteNumber(value.inconclusiveRate) && value.inconclusiveRate >= 0 && value.inconclusiveRate <= 1 && (value.measuredFpOfFiredRules === void 0 || isFiniteNumber(value.measuredFpOfFiredRules) && value.measuredFpOfFiredRules >= 0 && value.measuredFpOfFiredRules <= 1) && isStringArray(value.provisionalRuleIds) && (value.confidenceCeiling === void 0 || isFiniteNumber(value.confidenceCeiling) && value.confidenceCeiling >= 0 && value.confidenceCeiling <= 1) && isStringArray(value.ceilingReasons);
 }
 function isValidProvenance(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return isNonNegativeInteger(value.testFiles) && isNonNegativeInteger(value.generatedMarkedFiles) && isNonNegativeInteger(value.codegenLikeFiles) && isFiniteNumber(value.shareMarkedGenerated) && value.shareMarkedGenerated >= 0 && value.shareMarkedGenerated <= 1 && isNonNegativeInteger(value.findingsInGeneratedFiles) && isNonNegativeInteger(value.findingsInUnmarkedFiles) && typeof value.note === "string";
 }
 function isValidForensicVerdicts(value) {
-	if (!isRecord$3(value) || !isRecord$3(value.byVerdict)) return false;
+	if (!isRecord(value) || !isRecord(value.byVerdict)) return false;
 	return isNonNegativeInteger(value.classifications) && isNonNegativeInteger(value.inconclusive) && Object.values(value.byVerdict).every((count) => isNonNegativeInteger(count));
 }
 function isValidSummary(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return typeof value.digest === "string" && value.digest.length > 0 && isNonNegativeInteger(value.findings) && (value.score === null || isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100) && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos) && isNonNegativeInteger(value.advisory);
 }
 function isValidAnnotation(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return typeof value.path === "string" && value.path.length > 0 && isPositiveInteger(value.start_line) && (value.annotation_level === "failure" || value.annotation_level === "warning" || value.annotation_level === "notice") && typeof value.message === "string" && typeof value.ruleId === "string" && value.ruleId.length > 0 && (value.detectorRevision === void 0 || isPositiveInteger(value.detectorRevision)) && typeof value.advisory === "boolean";
 }
 function isValidCompleteness(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return typeof value.partial === "boolean" && (value.discovery === "complete" || value.discovery === "partial") && (value.rules === "complete" || value.rules === "partial") && isNonNegativeInteger(value.skippedFiles) && isNonNegativeInteger(value.rulesCrashed) && isStringArray(value.truncationReasons) && typeof value.frameworkDetectionUnknown === "boolean" && isFiniteNumber(value.durationMs) && value.durationMs >= 0;
 }
 function isValidContract(value) {
-	if (!isRecord$3(value)) return false;
+	if (!isRecord(value)) return false;
 	return Number.isSafeInteger(value.contractVersion) && isValidSummary(value.summary) && Array.isArray(value.annotations) && value.annotations.length <= 50 && value.annotations.every((annotation) => isValidAnnotation(annotation)) && typeof value.annotationsTruncated === "boolean" && isValidCompleteness(value.completeness) && (value.trustSummary === void 0 || isValidTrustSummary(value.trustSummary)) && (value.provenance === void 0 || isValidProvenance(value.provenance)) && (value.forensicVerdicts === void 0 || isValidForensicVerdicts(value.forensicVerdicts));
 }
 function isScanResultDocument(value) {
-	if (!isRecord$3(value) || value.schemaVersion !== 1) return false;
+	if (!isRecord(value) || value.schemaVersion !== 1) return false;
 	return (value.score === null || isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100) && typeof value.partial === "boolean" && isStringArray(value.frameworks) && Array.isArray(value.dimensions) && value.dimensions.every((dimension) => isValidDimension(dimension)) && Array.isArray(value.findings) && value.findings.every((finding) => isValidFinding(finding)) && isValidAnalysisStatus(value.analysisStatus) && (value.agenticProfile === void 0 || isValidProvenance(value.agenticProfile)) && (value.trustSummary === void 0 || isValidTrustSummary(value.trustSummary)) && (value.forensicVerdicts === void 0 || isValidForensicVerdicts(value.forensicVerdicts)) && isValidContract(value.contract);
 }
 function emitVerification(verification, json, io) {
@@ -15299,7 +16660,7 @@ async function runTrustTrendCommand(argv, io = {
 		const snapshot = computeTrustSnapshot(scan.result, scan.result.runIdentity, scan.result.trustSummary, args.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString());
 		const merged = new Map(history.map((entry) => [`${entry.scanId}\u0000${entry.timestamp}`, entry]));
 		merged.set(`${snapshot.scanId}\u0000${snapshot.timestamp}`, snapshot);
-		const snapshots = [...merged.values()].sort((left, right) => left.timestamp.localeCompare(right.timestamp) || left.scanId.localeCompare(right.scanId));
+		const snapshots = [...merged.values()].sort((left, right) => compareCodePoints(left.timestamp, right.timestamp) || compareCodePoints(left.scanId, right.scanId));
 		writeFileAtomic(historyPath, `${JSON.stringify(snapshots, null, 2)}\n`);
 		const trend = analyzeTrustTrends(snapshots);
 		if (args.json) io.out(JSON.stringify(trend, null, 2));
@@ -15366,8 +16727,8 @@ async function runCIIntegrityCommand(argv, io = {
 //#region src/cli.ts
 /**
 * Mjölnir CLI entry point (W1-02).
-* Exit codes (§24.1, frozen): 0 clean · 1 findings ≥ gate · 2 partial ·
-* 10 usage error · 20 internal error.
+* Exit codes (§24.1, frozen): 0 clean · 1 findings ≥ gate · 2 partial ·
+* 10 usage error · 20 internal error.
 */
 /**
 * Tool version for `mjolnir --version`.
@@ -15530,7 +16891,7 @@ function levenshtein(a, b) {
 	};
 	return walk(0, 0);
 }
-/** Nearest known flags within distance ≤ 2, nearest first. */
+/** Nearest known flags within distance ≤ 2, nearest first. */
 function nearestFlags(flag, max = 3) {
 	return KNOWN_SCAN_FLAGS.map((f) => ({
 		f,